Trojan.KeyLogger.42626

Technical Information

Malicious functions

Installs hooks to intercept notifications

on keystrokes:

Handler for all processes: <Current directory>\cfgdll.dll

Modifies file system

Creates the following files

%TEMP%\mymacro_errinfo.exe
<Current directory>\coc\q9-1.bmp
<Current directory>\coc\q9-2.bmp
<Current directory>\coc\q9-11.bmp
<Current directory>\coc\q9-12.bmp
<Current directory>\coc\q10(1).bmp
<Current directory>\coc\q10(2).bmp
<Current directory>\coc\q10.bmp
<Current directory>\coc\q8-2.bmp
<Current directory>\coc\q10-1.bmp
<Current directory>\coc\q9.bmp
<Current directory>\coc\q11(1).bmp
<Current directory>\coc\q11.bmp
<Current directory>\coc\q11-1.bmp
<Current directory>\coc\q11-2.bmp
<Current directory>\coc\q11-3.bmp
<Current directory>\coc\shanchu_a1.bmp
<Current directory>\coc\shanchu_a2.bmp
<Current directory>\coc\shanchu_a3.bmp
<Current directory>\coc\q10-2.bmp
<Current directory>\coc\shanchu_a4.bmp
<Current directory>\coc\q11(2).bmp
<Current directory>\coc\q8-3.bmp
<Current directory>\coc\q8-1.bmp
<Current directory>\coc\q8.bmp
<Current directory>\coc\liu_b3.bmp
<Current directory>\coc\liu_b4.bmp
<Current directory>\coc\liu_b5.bmp
<Current directory>\coc\liu_b6.bmp
<Current directory>\coc\lmb.bmp
<Current directory>\coc\lmb4.bmp
<Current directory>\coc\oppoВµВЇВґВ°.bmp
<Current directory>\coc\oppoВµВЇВґВ°1.bmp
<Current directory>\coc\liu_b1.bmp
<Current directory>\coc\peizhiyaoshui.bmp
<Current directory>\coc\q3.bmp
<Current directory>\coc\q4.bmp
<Current directory>\coc\q4-1.bmp
<Current directory>\coc\q5.bmp
<Current directory>\coc\q5-1.bmp
<Current directory>\coc\q5-2.bmp
<Current directory>\coc\q6.bmp
<Current directory>\coc\q6-1.bmp
<Current directory>\coc\q6-2.bmp
<Current directory>\coc\podun.bmp
<Current directory>\coc\q7.bmp
<Current directory>\coc\zbcs_b66.bmp
<Current directory>\coc\liu_b2.bmp
<Current directory>\coc\liu_a10.bmp
<Current directory>\coc\shanchu_a9.bmp
<Current directory>\coc\zbcs_a44.bmp
<Current directory>\coc\zbcs_a55.bmp
<Current directory>\coc\zbcs_a66.bmp
<Current directory>\coc\zbcs_a77.bmp
<Current directory>\coc\zbcs_a88.bmp
<Current directory>\coc\zbcs_a99.bmp
<Current directory>\coc\zbcs_a1010.bmp
<Current directory>\coc\zbcs_a11.bmp
<Current directory>\coc\zbcs_b1.bmp
<Current directory>\coc\zbcs_a33.bmp
<Current directory>\coc\zbcs_b3.bmp
<Current directory>\coc\zbcs_b5.bmp
<Current directory>\coc\zbcs_b6.bmp
<Current directory>\coc\zbcs_b11.bmp
<Current directory>\coc\zbcs_b22.bmp
<Current directory>\coc\zbcs_b33.bmp
<Current directory>\coc\zbcs_b44.bmp
<Current directory>\coc\zbcs_b55.bmp
<Current directory>\coc\zbcs_b2.bmp
<Current directory>\coc\shanchu_a5.bmp
<Current directory>\coc\zbcs_b4.bmp
<Current directory>\coc\zbcs_a22.bmp
<Current directory>\coc\zbcs_a10.bmp
<Current directory>\coc\zbcs_a9.bmp
<Current directory>\coc\shanchu_a10.bmp
<Current directory>\coc\shanchu_b1.bmp
<Current directory>\coc\shanchu_b2.bmp
<Current directory>\coc\shanchu_b3.bmp
<Current directory>\coc\shanchu_b4.bmp
<Current directory>\coc\shanchu_b5.bmp
<Current directory>\coc\shanchu_b6.bmp
<Current directory>\coc\shandianyaoshui.bmp
<Current directory>\coc\shanchu_a8.bmp
<Current directory>\coc\sscc.bmp
<Current directory>\coc\xljd.bmp
<Current directory>\coc\xunlianjundui.bmp
<Current directory>\coc\zbcs_a1.bmp
<Current directory>\coc\zbcs_a2.bmp
<Current directory>\coc\zbcs_a3.bmp
<Current directory>\coc\zbcs_a4.bmp
<Current directory>\coc\zbcs_a5.bmp
<Current directory>\coc\zbcs_a6.bmp
<Current directory>\coc\zbcs_a7.bmp
<Current directory>\coc\xinxi.bmp
<Current directory>\coc\zbcs_a8.bmp
<Current directory>\coc\shanchu_a7.bmp
<Current directory>\coc\bsГ¶ГёГ¦Гґ11.bmp
<Current directory>\coc\shanchu_a6.bmp
<Current directory>\coc\byb33.bmp
<Current directory>\coc\bya9.bmp
<Current directory>\coc\bya10.bmp
<Current directory>\coc\bya11.bmp
<Current directory>\coc\bya22.bmp
<Current directory>\coc\bya33.bmp
<Current directory>\coc\bya44.bmp
<Current directory>\coc\bya55.bmp
<Current directory>\coc\bya6.bmp
<Current directory>\coc\bya66.bmp
<Current directory>\coc\bya8.bmp
<Current directory>\coc\bya88.bmp
<Current directory>\coc\bya1010.bmp
<Current directory>\coc\byb1.bmp
<Current directory>\coc\byb2.bmp
<Current directory>\coc\byb3.bmp
<Current directory>\coc\byb4.bmp
<Current directory>\coc\byb5.bmp
<Current directory>\coc\byb6.bmp
<Current directory>\coc\bya77.bmp
<Current directory>\coc\byb11.bmp
<Current directory>\coc\bya99.bmp
<Current directory>\coc\bya7.bmp
<Current directory>\coc\bya5.bmp
<Current directory>\coc\bya4.bmp
<Current directory>\coc\bsГ¶ГёГ¦ГґГВ·ГЇГ±1.bmp
<Current directory>\coc\by_a1.bmp
<Current directory>\coc\by_a2.bmp
<Current directory>\coc\by_a3.bmp
<Current directory>\coc\by_a4.bmp
<Current directory>\coc\by_a5.bmp
<Current directory>\coc\by_a6.bmp
<Current directory>\coc\by_a7.bmp
<Current directory>\coc\bsГ¶ГёГ¦Гґ111.bmp
<Current directory>\coc\by_a8.bmp
<Current directory>\coc\by_aa.bmp
<Current directory>\coc\by_b1.bmp
<Current directory>\coc\by_b2.bmp
<Current directory>\coc\by_b3.bmp
<Current directory>\coc\by_b4.bmp
<Current directory>\coc\by_b5.bmp
<Current directory>\coc\by_b6.bmp
<Current directory>\coc\bya1.bmp
<Current directory>\coc\bya2.bmp
<Current directory>\coc\by_a9.bmp
<Current directory>\coc\bya3.bmp
<Current directory>\coc\liu_a7.bmp
<Current directory>\coc\liu_a9.bmp
<Current directory>\coc\liu_a8.bmp
<Current directory>\coc\byb66.bmp
<Current directory>\coc\geilichongqi.bmp
<Current directory>\coc\guan1.bmp
<Current directory>\coc\guan2.bmp
<Current directory>\coc\guan3.bmp
<Current directory>\coc\guan4.bmp
<Current directory>\coc\guan5.bmp
<Current directory>\coc\hy14.bmp
<Current directory>\coc\d5.bmp
<Current directory>\coc\hy56.bmp
<Current directory>\coc\fashupeizhi.bmp
<Current directory>\coc\kpchongqitouxiang.bmp
<Current directory>\coc\kuangbaoyaoshui.bmp
<Current directory>\coc\liu_a1.bmp
<Current directory>\coc\liu_a2.bmp
<Current directory>\coc\liu_a3.bmp
<Current directory>\coc\liu_a4.bmp
<Current directory>\coc\liu_a5.bmp
<Current directory>\coc\liu_a6.bmp
<Current directory>\coc\kaopu222.bmp
<Current directory>\coc\byb22.bmp
<Current directory>\coc\kpshanchu.bmp
<Current directory>\coc\d6.bmp
<Current directory>\coc\d4.bmp
<Current directory>\coc\d3.bmp
<Current directory>\coc\c1.bmp
<Current directory>\coc\c2.bmp
<Current directory>\coc\c3.bmp
<Current directory>\coc\c4.bmp
<Current directory>\coc\c5.bmp
<Current directory>\coc\c6.bmp
<Current directory>\coc\c7.bmp
<Current directory>\coc\c8.bmp
<Current directory>\coc\byb55.bmp
<Current directory>\coc\c9.bmp
<Current directory>\coc\caiji1.bmp
<Current directory>\coc\caiji2.bmp
<Current directory>\coc\caiji3.bmp
<Current directory>\coc\cb1.bmp
<Current directory>\coc\cb2.bmp
<Current directory>\coc\cb4.bmp
<Current directory>\coc\cb6.bmp
<Current directory>\coc\ccccqqqq.bmp
<Current directory>\coc\d1.bmp
<Current directory>\coc\ca.bmp
<Current directory>\coc\d2.bmp
<Current directory>\coc\byb44.bmp
<Current directory>\coc\bsГ¶ГёГ¦Гґ1111.bmp
<Current directory>\coc\zbhb_a1.bmp
<Current directory>\coc\zbhb_a6.bmp
<Current directory>\coc\ГЄГ·2.bmp
<Current directory>\coc\ГЄГ·3.bmp
<Current directory>\coc\ГЄГ·4.bmp
<Current directory>\coc\ГЄГ·5.bmp
<Current directory>\coc\Г«В®ВїГўГ®ВЄВїГµ.bmp
<Current directory>\coc\Г«В®Г°ГѕВёВґ.bmp
<Current directory>\coc\Г«В®Г°ГѕВёВґ1.bmp
<Current directory>\coc\ГЄВ¤Г Г»Г¶В®Г°Г§2.bmp
<Current directory>\coc\Г«Г±Г«Г·В¶ГґГЄГ¶.bmp
<Current directory>\coc\ГЄГ·1.bmp
<Current directory>\coc\Г«Г±Г«Г·В¶ГґГЄГ¶2.bmp
<Current directory>\coc\Г¬Г¬ГЄВ№.bmp
<Current directory>\coc\Г¬Г®ВіГ¤ВєГєГіГ.bmp
<Current directory>\coc\ГВЈГ¶В№В№В¤Г—Г·.bmp
<Current directory>\coc\ГВЈГ¶В№ГґГ«Г°Г°.bmp
<Current directory>\coc\Г®ГѕГЇГ¬ГіВ¦.bmp
<Current directory>\coc\ГЇВ®В»Г·.bmp
<Current directory>\coc\ГЇГўВµВЇГ¬Гё.bmp
<Current directory>\coc\Г«Г±Г«Г·В¶ГґГЄГ¶1.bmp
<Current directory>\coc\ГЇГўГ©ГЎВµГ§.bmp
<Current directory>\coc\Г¬ГЎГ§В°ВЅГЎГЄГёГЁВ·ГЁГЇ.bmp
<Current directory>\coc\ГЄВ±ВјГ¤ГІГ±Г±ГіВіВ¤.bmp
<Current directory>\coc\ГЄВ¤Г Г»Г¶В®Г°Г§1.bmp
<Current directory>\coc\Г©ГЅВјВ¶ВµГ¤ГіВЄ.bmp
<Current directory>\coc\ВїВїГ¦Г—Г¶ГёГ¦Гґ.bmp
<Current directory>\coc\ВїГµВ№Гѕ.bmp
<Current directory>\coc\Г ВГґВ¶01.bmp
<Current directory>\coc\Г ВГґВ¶02.bmp
<Current directory>\coc\Г ВГґВ¶03.bmp
<Current directory>\coc\ГЎВ¬ВЅГіГ¶Г°В¶ГЇ.bmp
<Current directory>\coc\ГЎВЄГЇГ«В№ГёВ±Гµ.bmp
<Current directory>\coc\ГЎГ№Г°ВЎГЄВ±ГЇГўГЇГџ.bmp
<Current directory>\coc\ВїВїГ¦Г—Г©ВѕВіГЅ1.bmp
<Current directory>\coc\ГҐГ°В¶ГЇГ¶ГёГ¦Гґ.bmp
<Current directory>\coc\Г¦Г В·Г¶.bmp
<Current directory>\coc\Г¦ГёГ§ГІ.bmp
<Current directory>\coc\Г§ВїГ¶Г¦ГЇГўГЇГџВЅГЎГЄГё.bmp
<Current directory>\coc\Г§ВїГ¶Г¦ГЇГўГЇГџГ±ГіВіВ¤.bmp
<Current directory>\coc\Г§Г«Г§ГіГґВ®В±Гё.bmp
<Current directory>\coc\Г§Г«Г¶ГёГЄГґ.bmp
<Current directory>\coc\ГЁВГВ·.bmp
<Current directory>\coc\ГЁВ·В¶ВЁГЄГµГ—ГЄГґВґВіВµ.bmp
<Current directory>\coc\Г©ГЎВµГ§ГІВ©Г«В®.bmp
<Current directory>\coc\ГҐГ»В·Г§.bmp
<Current directory>\coc\Г©ГЅВјВ¶ВµГ¤ВіВ§.bmp
<Current directory>\coc\ВїВїГ¦Г—Г©ВѕВіГЅ.bmp
<Current directory>\coc\ВїВїГ¦Г—Г©ВѕВіГЅ2.bmp
<Current directory>\coc\ГЇГўГ©ГЎВµГ§1.bmp
<Current directory>\coc\ГІВ»ВјГјГ§Г«Г§ГіГґГ¶ГґВ®.bmp
<Current directory>\coc\ГґГ¶ГґВ®.bmp
<Current directory>\coc\Г¶Г®ГЎГ¦.bmp
<Current directory>\coc\Г¶Г®ГЎГ¦1.bmp
<Current directory>\coc\Г¶ГёГ°ГўВјГіГґГёВ±В»В¶ВҐВєГҐ.bmp
<Current directory>\coc\Г¶ГёГ°ГўГґГёГЁГ«.bmp
<Current directory>\coc\Г¶ГёГ°ГўГґГёГЁГ«ГіГ®ГЇВ·.bmp
<Current directory>\coc\Г—ГЄГґВґВіВµ1.bmp
<Current directory>\coc\Г—ГЄГґВґВіВµ2.bmp
<Current directory>\coc\ГґГєГґГ¬Г©ГЎВµГ§.bmp
<Current directory>\coc\ГґГєГґГ¬Г¶Г®ГЎГ¦.bmp
<Current directory>\coc\Г—ГЄГґВґВіВµ3.bmp
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020042820200429\index.dat
<Current directory>\coc\bluestacksВ·Г¶В±Г¦ГўГЄГ°ГѕВёГ¤Г®ВЄ800x637_Г¶В§ВіГ¶0.9.reg
<Current directory>\coc\bluestacksВ·Г¶В±Г¦ГўГЄГ°ГѕВёГ¤Г®ВЄ800x685_Г¶В§ВіГ¶0.9.reg
<Current directory>\coc\bsВ·Г¶В±Г¦ГўГЄ.reg
<Current directory>\coc\dm.dll
<Current directory>\coc\regdll.dll
<Current directory>\coc\3В±ВѕВґГІВ·ВЁ.ini
<Current directory>\coc\4В±ВѕВґГІВ·ВЁ.ini
<Current directory>\coc\Г—ГЄГґВґВіВµ4.bmp
<Current directory>\coc\Г—Г®Г°ГўbsГ¶ГёГ¦Гґ.bmp
<Current directory>\coc\ГґГєГґГ¬ВїГ±В±В©.bmp
<Current directory>\coc\ГґГєГЇГџГЄВ±ВјГ¤.bmp
<Current directory>\coc\36.bmp
<Current directory>\coc\ГІГ±ГіГ°ВїГ±В±В©.bmp
<Current directory>\coc\ГІГ±ГіГ°Г©ГЎВµГ§.bmp
<Current directory>\coc\ГІГ±ГіГ°Г¶Г®ГЎГ¦.bmp
<Current directory>\coc\ГіГВ№Гѕ2-1.bmp
<Current directory>\coc\ГіГВ№Гѕ2-2.bmp
<Current directory>\coc\ГіГВ№Гѕ2-3.bmp
<Current directory>\coc\ГіГВ№Гѕ3-1.bmp
<Current directory>\coc\ГіГВ№Гѕ4-1.bmp
<Current directory>\coc\ГіГВ№Гѕ5-1.bmp
<Current directory>\coc\ГіГВ№Гѕ5-2.bmp
<Current directory>\coc\ГіГВ№Гѕ5-3.bmp
<Current directory>\coc\ГіГВ№Гѕ5-4.bmp
<Current directory>\coc\ГіГВ№Гѕ5-5.bmp
<Current directory>\coc\ГіГВ№Гѕ6-1.bmp
<Current directory>\coc\ГіГВ№Гѕ6-2.bmp
<Current directory>\coc\ГіГВ№Гѕ6-3.bmp
<Current directory>\coc\ГіГВ№Гѕ6-4.bmp
<Current directory>\coc\ГіГ°ГЁГ«ГўГ°.bmp
<Current directory>\coc\ГґГёГЁГ«ВЅГёВ¶ГЁ.bmp
<Current directory>\coc\ГЇГўГ©ГЎВµГ§2.bmp
<Current directory>\coc\ГІВ©Г«В®ГіВЄ.bmp
<Current directory>\coc\ГЇГўГЄГёВ»В¤ГµГџ.bmp
<Current directory>\coc\zbhb_a3.bmp
<Current directory>\coc\zbhb_a2.bmp
<Current directory>\coc\ВѕГЁГґГ№ВІВїВ¶Гі.bmp
<Current directory>\coc\zz_b2.bmp
<Current directory>\coc\zz_b3.bmp
<Current directory>\coc\zz_b4.bmp
<Current directory>\coc\zz_b5.bmp
<Current directory>\coc\zz_b6.bmp
<Current directory>\coc\В°Г№В¶ГЁx.bmp
<Current directory>\coc\zz_a7.bmp
<Current directory>\coc\В°Г№В¶ГЁВµГ§ГўВј.bmp
<Current directory>\coc\ВІГ©ВјВЇВєГєГіГ.bmp
<Current directory>\coc\zz_b1.bmp
<Current directory>\coc\ВґГҐГ—ВЇГЄГёГ®Г .bmp
<Current directory>\coc\В·ГҐГ¦Гє.bmp
<Current directory>\coc\В·ГҐГ¦Гє+ВЅГЎГЄГёГµВЅВ¶В·.bmp
<Current directory>\coc\В·Г»Г©В«ВІГ©ВјВЇГ¦Г·ВјГіГ«Г№.bmp
<Current directory>\coc\В№В¤ВіВ§1.bmp
<Current directory>\coc\В№В¤ВіВ§2.bmp
<Current directory>\coc\В№В¤ВіВ§3.bmp
<Current directory>\coc\ВІВ»ГВ¬ВІВЅ1.bmp
<Current directory>\coc\zz_a6.bmp
<Current directory>\coc\ВїВїГ¦Г—ВµГ§ГўВј.bmp
<Current directory>\coc\ВµГ§ГўВј2Г—Г¶.bmp
<Current directory>\coc\zz_a9.bmp
<Current directory>\coc\zz_a5.bmp
<Current directory>\coc\zz_a4.bmp
<Current directory>\coc\zbhb_a7.bmp
<Current directory>\coc\zbhb_a8.bmp
<Current directory>\coc\zbhb_a9.bmp
<Current directory>\coc\zbhb_a10.bmp
<Current directory>\coc\zbhb_b1.bmp
<Current directory>\coc\zbhb_b2.bmp
<Current directory>\coc\zbhb_b3.bmp
<Current directory>\coc\zbhb_b4.bmp
<Current directory>\coc\zbhb_a5.bmp
<Current directory>\coc\zbhb_b5.bmp
<Current directory>\coc\zd_lan.bmp
<Current directory>\coc\zd_zi.bmp
<Current directory>\coc\zuojt.bmp
<Current directory>\coc\zz.bmp
<Current directory>\coc\zz_10.bmp
<Current directory>\coc\zz_a1.bmp
<Current directory>\coc\zz_a2.bmp
<Current directory>\coc\zz_a3.bmp
<Current directory>\coc\В№В¤ВіВ§4.bmp
<Current directory>\coc\zbhb_b6.bmp
<Current directory>\coc\zbhb_a4.bmp
<Current directory>\coc\zz_a8.bmp
<Current directory>\coc\ВїВїГ¦Г—Г¦ГґВ¶ВЇВјГі1.bmp
<Current directory>\coc\В№В¤ВіВ§5.bmp
<Current directory>\coc\В»ВЄГ®ВЄВµГ§ГўВј.bmp
<Current directory>\coc\ВѕГЁВёГ§ВІВјГЎГ¶.bmp
<Current directory>\coc\ВѕГЁВ№ВВјГЅ.bmp
<Current directory>\coc\ВѕГЁГЎГґГЁВ®.bmp
<Current directory>\coc\ВѕГЁГЎГє.bmp
<Current directory>\coc\ВѕГЁГҐВ®Г®Г—.bmp
<Current directory>\coc\ВѕГЁГҐГ¶Г—Гі.bmp
<Current directory>\coc\ВѕГЁВ±ГёВ№ВВјГЅ.bmp
<Current directory>\coc\ВѕГЁГҐГ¶Г—Гі1.bmp
<Current directory>\coc\ВѕГЁГ¦В¤ВїВЁ.bmp
<Current directory>\coc\ВѕГЁВ·ВЁГЄВ¦3.bmp
<Current directory>\coc\ВѕГЁГ¦ГёГ§ГІ.bmp
<Current directory>\coc\ВѕГЁГ¬Г¬ГЄВ№.bmp
<Current directory>\coc\ВѕГЁГГ¶ГЎГ©.bmp
<Current directory>\coc\ВѕГЁГ®Г¤Г©Г±.bmp
<Current directory>\coc\ВѕГЁГІВ°ГўГ№ГЁГ«.bmp
<Current directory>\coc\ВѕГЁГІВ°Г¶Г.bmp
<Current directory>\coc\ВѕГЁГІВ°Г¶Г1.bmp
<Current directory>\coc\ВѕГЁГҐГ¶Г—Гі2.bmp
<Current directory>\coc\ВѕГЁВ±ГёВґГІВїВЄ1.bmp
<Current directory>\coc\В№Г»ГҐГ¬ВµГ§ГўВј.bmp
<Current directory>\coc\ВѕГЁГЄВЇГВ·.bmp
<Current directory>\coc\ВѕГЁВ·ВЁГЄВ¦2.bmp
<Current directory>\coc\ВѕГЁВ±ГёВґГІВїВЄ.bmp
<Current directory>\coc\ВѕГҐГіГ®ВµГ§ГўВј.bmp
<Current directory>\coc\В»ВЄГ®ВЄГЁВЎГЇГ»ВёГјГ°Гў.bmp
<Current directory>\coc\В»ГёГіВЄ.bmp
<Current directory>\coc\В»ГёГіВЄ2.bmp
<Current directory>\coc\ВјГіГ«Г№.bmp
<Current directory>\coc\ВјГіГ«Г№1.bmp
<Current directory>\coc\ВјГіГ«Г№2.bmp
<Current directory>\coc\ВјГіГ«Г№3.bmp
<Current directory>\coc\ВјГіГ«Г№ВµГ¤ВіВ§.bmp
<Current directory>\coc\ВєГ¬ГЇГџb.bmp
<Current directory>\coc\ВјГіГ«Г№ВµГ¤ГіВЄ.bmp
<Current directory>\coc\ВЅВЈ1.bmp
<Current directory>\coc\ВЅГЎГЄГёГµВЅВ¶В·.bmp
<Current directory>\coc\ВЅГ°Г°ГѕВёВґ.bmp
<Current directory>\coc\ВЅГёВ№ВҐ.bmp
<Current directory>\coc\ВЅГёВ№ВҐ1.bmp
<Current directory>\coc\ВЅГёВ№ВҐ2.bmp
<Current directory>\coc\ВЅГёВ№ВҐ3.bmp
<Current directory>\coc\ВѕГҐГіГ®x.bmp
<Current directory>\coc\В№Г»ГҐГ¬x.bmp
<Current directory>\coc\ВЅВЈ.bmp
<Current directory>\coc\ВєГ¬ГЇГџa.bmp
<Current directory>\coc\ВѕГЁВ·ВЁГЄВ¦.bmp
<Current directory>\coc\bsГ¶ГёГ¦Гґ1.bmp
<Current directory>\coc\bsГ¶ГёГ¦Гґ.bmp
<Current directory>\coc\bsГ°ВЎГВјГ¦ГґВ¶ВЇ.bmp
<Current directory>\coc\7pj001.bmp
<Current directory>\coc\7pj002.bmp
<Current directory>\coc\7pj003.bmp
<Current directory>\coc\7pj004.bmp
<Current directory>\coc\7pj005.bmp
<Current directory>\coc\7pj006.bmp
<Current directory>\coc\7pj007.bmp
<Current directory>\coc\7b-3.bmp
<Current directory>\coc\7В±Вѕ-1.bmp
<Current directory>\coc\7guohuo.bmp
<Current directory>\coc\7В±ВѕГ©ГЇ.bmp
<Current directory>\coc\7ВЅГ°ВґГёГ±В©.bmp
<Current directory>\coc\7Г«В®.bmp
<Current directory>\coc\7Г«В®ВґГёГ±В©.bmp
<Current directory>\coc\08bsГ¦ГґВ¶ВЇ3.bmp
<Current directory>\coc\08bsГ¦ГґВ¶ВЇ4.bmp
<Current directory>\coc\08bsГ©ВѕВіГЅ1.bmp
<Current directory>\coc\08bsГ©ВѕВіГЅ2.bmp
<Current directory>\coc\7В±Вѕ-2.bmp
<Current directory>\coc\7b-2.bmp
<Current directory>\coc\7В±ВѕГЇГў.bmp
<Current directory>\coc\7b-1ВґГёГ±В©.bmp
<Current directory>\coc\7b-1.bmp
<Current directory>\coc\4xn001.bmp
<Current directory>\coc\4xn003.bmp
<Current directory>\coc\4xn004.bmp
<Current directory>\coc\4xn005.bmp
<Current directory>\coc\4xn006.bmp
<Current directory>\coc\4xn007.bmp
<Current directory>\coc\4xn008.bmp
<Current directory>\coc\4xn009.bmp
<Current directory>\coc\5.bmp
<Current directory>\coc\5guohuo.bmp
<Current directory>\coc\4xn002.bmp
<Current directory>\coc\5Г°Г§.bmp
<Current directory>\coc\6b-1.bmp
<Current directory>\coc\6guohuo.bmp
<Current directory>\coc\6pj001.bmp
<Current directory>\coc\6pj002.bmp
<Current directory>\coc\6pj003.bmp
<Current directory>\coc\6pj004.bmp
<Current directory>\coc\6ВјВ¶ГЎВЄГЈГ«В±Гё.bmp
<Current directory>\coc\7.bmp
<Current directory>\coc\8.bmp
<Current directory>\coc\6.bmp
<Current directory>\coc\4guohuo2.bmp
<Current directory>\coc\9В±Вѕ-5.bmp
<Current directory>\coc\4guohuo.bmp
<Current directory>\coc\09bsГ¦ГґВ¶ВЇ12.bmp
<Current directory>\coc\9.bmp
<Current directory>\coc\9b-1.bmp
<Current directory>\coc\9b-1ВґГёГ±В©.bmp
<Current directory>\coc\9b-2.bmp
<Current directory>\coc\9bsГ©ВѕВіГЅ.bmp
<Current directory>\coc\9bsГ©ВѕВіГЅ2.bmp
<Current directory>\coc\9fen.bmp
<Current directory>\coc\09bsГ¦ГґВ¶ВЇ11.bmp
<Current directory>\coc\9pj001.bmp
<Current directory>\coc\09bsГ¶ГёГ¦Гґ1.bmp
<Current directory>\coc\9pj003.bmp
<Current directory>\coc\9pj005.bmp
<Current directory>\coc\9pj006.bmp
<Current directory>\coc\9pj007.bmp
<Current directory>\coc\9В±Вѕ-1.bmp
<Current directory>\coc\9В±Вѕ-2.bmp
<Current directory>\coc\9В±Вѕ-3.bmp
<Current directory>\coc\9В±Вѕ-4.bmp
<Current directory>\coc\9pj002.bmp
<Current directory>\coc\09bsbaikuang.bmp
<Current directory>\coc\9pj004.bmp
<Current directory>\coc\8Г«В®-1.bmp
<Current directory>\coc\8Г«В®.bmp
<Current directory>\coc\8b-1ВґГёГ±В©.bmp
<Current directory>\coc\8b-3.bmp
<Current directory>\coc\8fen.bmp
<Current directory>\coc\8guohuo.bmp
<Current directory>\coc\8pj001.bmp
<Current directory>\coc\8pj002.bmp
<Current directory>\coc\8pj003.bmp
<Current directory>\coc\8pj004.bmp
<Current directory>\coc\8pj005.bmp
<Current directory>\coc\8pj006.bmp
<Current directory>\coc\8b-2.bmp
<Current directory>\coc\8pj007.bmp
<Current directory>\coc\8pj009.bmp
<Current directory>\coc\8pj010.bmp
<Current directory>\coc\8В±Вѕ-1.bmp
<Current directory>\coc\8В±Вѕ-2.bmp
<Current directory>\coc\8В±Вѕ-3.bmp
<Current directory>\coc\8В±ВѕГ©ГЇ.bmp
<Current directory>\coc\8В±ВѕГЇГў.bmp
<Current directory>\coc\8ВЅГ°ВґГёГ±В©.bmp
<Current directory>\coc\8-9Г«В®ВґГёГ±В©.bmp
<Current directory>\coc\8pj008.bmp
<Current directory>\coc\8-9Г«В®.bmp
<Current directory>\coc\8b-1.bmp
<Current directory>\coc\4dy002.bmp
<Current directory>\coc\1dy004.bmp
<Current directory>\coc\ВёГџВјВ¶.txt
<Current directory>\coc\ВєГ«Г°Г¤.txt
<Current directory>\coc\ВјГіГ«Г№.txt
<Current directory>\coc\ВјГ ВїГё.txt
<Current directory>\coc\ВѕГЁВ±Гё.txt
<Current directory>\coc\ВѕГЁВ±ГёГ—Г¶ВїГў.txt
<Current directory>\coc\ГЁГµГ¶Вѕ.txt
<Current directory>\coc\ВґГІГіГЈ.txt
<Current directory>\coc\Г©ГЅВјВ¶.txt
<Current directory>\coc\В·ГҐВ±Гё.txt
<Current directory>\coc\Г«Г±ГіГЈГ—Г¶ВїГў.txt
<Current directory>\coc\ГВіВјГ¦.txt
<Current directory>\coc\ГЇГЄГ§Г©Г—Г¶Г¬ГҐ.txt
<Current directory>\coc\Г°В§ГўГЄ.txt
<Current directory>\coc\Г°ГҐГЇВў.txt
<Current directory>\coc\ГґГ¬В±Гё.txt
<Current directory>\coc\ГµВЅВ№Г»Г—Г¶ВїГў.txt
<Current directory>\coc\1.bmp
<Current directory>\coc\Г«Г±ГіГЈ.txt
<Current directory>\coc\В±ГёГіВЄ.txt
<Current directory>\coc\ГВЁГіГЈ.txt
<Current directory>\coc\В±ГёГЎВ¦.txt
<Current directory>\coc\В±В.txt
%TEMP%\mac2aac.tmp
%TEMP%\plugin.zip
<Current directory>\plugin\sys.dll
<Current directory>\plugin\regdll.dll
<Current directory>\plugin\window.dll
<Current directory>\plugin\file.dll
%TEMP%\mymacro.zip
%TEMP%\background.bmp
<Current directory>\cfgdll.dll
<Current directory>\shieldmodule.dat
%TEMP%\mac2aad.tmp.qtmp
%APPDATA%\mymacro\qdisp.dll
<PATH_SAMPLE>.ini
%APPDATA%\qmacro\shield\sd000.dat
%APPDATA%\qmacro\shield\sd001.dat
%APPDATA%\qmacro\shield\sd002.dat
%APPDATA%\qmacro\shield\sd003.dat
%APPDATA%\qmacro\shield\sd004.dat
%APPDATA%\qmacro\shield\shield.ini
<Current directory>\plugin\sys.ini
<Current directory>\coc\1dy001.bmp
%TEMP%\d0248e4.tmp
<Current directory>\coc\4dy003.bmp
<Current directory>\coc\9В±Вѕ-6.bmp
<Current directory>\coc\ВµВ±Г§В°Г—ГЄГґВґ.txt
<Current directory>\coc\3dy007.bmp
<Current directory>\coc\3guohuo.bmp
<Current directory>\coc\3xn001.bmp
<Current directory>\coc\3xn002.bmp
<Current directory>\coc\3xn003.bmp
<Current directory>\coc\3xn004.bmp
<Current directory>\coc\3xn005.bmp
<Current directory>\coc\3xn006.bmp
<Current directory>\coc\3dy006.bmp
<Current directory>\coc\3xn007.bmp
<Current directory>\coc\3dy008.bmp
<Current directory>\coc\3xn009.bmp
<Current directory>\coc\3xn011.bmp
<Current directory>\coc\3xn012.bmp
<Current directory>\coc\3xn013.bmp
<Current directory>\coc\4.bmp
<Current directory>\coc\4-6В±ВѕГ©ГЇ.bmp
<Current directory>\coc\4-6В±ВѕГЇГў.bmp
<Current directory>\coc\4dy001.bmp
<Current directory>\coc\3xn008.bmp
<Current directory>\coc\3dy005.bmp
<Current directory>\coc\3xn010.bmp
<Current directory>\coc\3dy004.bmp
<Current directory>\coc\3dy003.bmp
<Current directory>\coc\1dy005.bmp
<Current directory>\coc\1dy007.bmp
<Current directory>\coc\1xn001.bmp
<Current directory>\coc\1xn002.bmp
<Current directory>\coc\1xn003.bmp
<Current directory>\coc\1xn004.bmp
<Current directory>\coc\1xn005.bmp
<Current directory>\coc\1В±В¦ГЄВЇВјГіГ«Г№.bmp
<Current directory>\coc\2.bmp
<Current directory>\coc\2dy001.bmp
<Current directory>\coc\1dy006.bmp
<Current directory>\coc\2dy002.bmp
<Current directory>\coc\2dy004.bmp
<Current directory>\coc\2xn001.bmp
<Current directory>\coc\2xn002.bmp
<Current directory>\coc\2xn003.bmp
<Current directory>\coc\2xn005.bmp
<Current directory>\coc\3.bmp
<Current directory>\coc\3dy001.bmp
<Current directory>\coc\3dy002.bmp
<Current directory>\coc\1dy003.bmp
<Current directory>\coc\2dy003.bmp
<Current directory>\coc\1dy002.bmp
<Current directory>\coc\7b-4.bmp
<Current directory>\coc\9В±Вѕ-7.bmp
<Current directory>\coc\85.bmp
<Current directory>\coc\88.bmp
<Current directory>\coc\89.bmp
<Current directory>\coc\90.bmp
<Current directory>\coc\91.bmp
<Current directory>\coc\92.bmp
<Current directory>\coc\93.bmp
<Current directory>\coc\84.bmp
<Current directory>\coc\94.bmp
<Current directory>\coc\96.bmp
<Current directory>\coc\87.bmp
<Current directory>\coc\97.bmp
<Current directory>\coc\99.bmp
<Current directory>\coc\100.bmp
<Current directory>\coc\101.bmp
<Current directory>\coc\102.bmp
<Current directory>\coc\103.bmp
<Current directory>\coc\104.bmp
<Current directory>\coc\95.bmp
<Current directory>\coc\83-2.bmp
<Current directory>\coc\63.bmp
<Current directory>\coc\98.bmp
<Current directory>\coc\86.bmp
<Current directory>\coc\83.bmp
<Current directory>\coc\83(1).bmp
<Current directory>\coc\67.bmp
<Current directory>\coc\68.bmp
<Current directory>\coc\69.bmp
<Current directory>\coc\70.bmp
<Current directory>\coc\71.bmp
<Current directory>\coc\72.bmp
<Current directory>\coc\73.bmp
<Current directory>\coc\74.bmp
<Current directory>\coc\65.bmp
<Current directory>\coc\75.bmp
<Current directory>\coc\77.bmp
<Current directory>\coc\78.bmp
<Current directory>\coc\79.bmp
<Current directory>\coc\80.bmp
<Current directory>\coc\81.bmp
<Current directory>\coc\82(1).bmp
<Current directory>\coc\82.bmp
<Current directory>\coc\82-2.bmp
<Current directory>\coc\105.bmp
<Current directory>\coc\76.bmp
<Current directory>\coc\64.bmp
<Current directory>\coc\61.bmp
<Current directory>\coc\66.bmp
<Current directory>\coc\106.bmp
<Current directory>\coc\111.bmp
<Current directory>\coc\abz_3.bmp
<Current directory>\coc\abz_4.bmp
<Current directory>\coc\abz_5.bmp
<Current directory>\coc\abz_6.bmp
<Current directory>\coc\abz_7.bmp
<Current directory>\coc\abz_8.bmp
<Current directory>\coc\926bsГ¦ГґВ¶ВЇ.bmp
<Current directory>\coc\abz_9.bmp
<Current directory>\coc\bbz_1.bmp
<Current directory>\coc\abz_2.bmp
<Current directory>\coc\bbz_2.bmp
<Current directory>\coc\bbz_4.bmp
<Current directory>\coc\bbz_5.bmp
<Current directory>\coc\bbz_6.bmp
<Current directory>\coc\bsqdtj.bmp
<Current directory>\coc\bsГ¦ГґВ¶ВЇ1213.bmp
<Current directory>\coc\bsГ©ВѕВіГЅ.bmp
<Current directory>\coc\abz_a.bmp
<Current directory>\coc\0810bsВµГ§ГўВј.bmp
<Current directory>\coc\108.bmp
<Current directory>\coc\bbz_3.bmp
<Current directory>\coc\abz_1.bmp
<Current directory>\coc\360В№ГЈВёГ¦3.bmp
<Current directory>\coc\360В№ГЈВёГ¦2.bmp
<Current directory>\coc\112.bmp
<Current directory>\coc\113.bmp
<Current directory>\coc\114.bmp
<Current directory>\coc\115.bmp
<Current directory>\coc\116.bmp
<Current directory>\coc\117.bmp
<Current directory>\coc\118.bmp
<Current directory>\coc\119.bmp
<Current directory>\coc\110.bmp
<Current directory>\coc\120.bmp
<Current directory>\coc\201.bmp
<Current directory>\coc\202.bmp
<Current directory>\coc\203.bmp
<Current directory>\coc\204.bmp
<Current directory>\coc\360gg.bmp
<Current directory>\coc\360ВµВЇВґВ°.bmp
<Current directory>\coc\360ВµВЇВґВ°ВјГі1.bmp
<Current directory>\coc\360ВµГ§ГўВј.bmp
<Current directory>\coc\107.bmp
<Current directory>\coc\121.bmp
<Current directory>\coc\109.bmp
<Current directory>\coc\926bsГ¦ГґВ¶ВЇ1.bmp
<Current directory>\coc\62.bmp
<Current directory>\coc\60.bmp
<Current directory>\coc\9В±ВѕГ©ГЇ.bmp
<Current directory>\coc\11В±Вѕ-1.bmp
<Current directory>\coc\11В±Вѕ-2.bmp
<Current directory>\coc\11ВЅГ°ВґГёГ±В©.bmp
<Current directory>\coc\11ВЅГ°ВґГёГ±В©ВјГіГ«Г№.bmp
<Current directory>\coc\11Г«В®.bmp
<Current directory>\coc\11Г«В®1.bmp
<Current directory>\coc\11Г«В®ВґГёГ±В©.bmp
<Current directory>\coc\11-12В·Г»Г«В®ВґГёГ±В©.bmp
<Current directory>\coc\11Г«В®ГЁВ«ГўГє.bmp
<Current directory>\coc\11fen.bmp
<Current directory>\coc\12fen.bmp
<Current directory>\coc\12Г«В®.bmp
<Current directory>\coc\12Г«В®1.bmp
<Current directory>\coc\12Г«В®2.bmp
<Current directory>\coc\12Г«В®ВґГёГ±В©.bmp
<Current directory>\coc\13.bmp
<Current directory>\coc\14.bmp
<Current directory>\coc\15.bmp
<Current directory>\coc\12.bmp
<Current directory>\coc\11-12В·Г»Г«В®.bmp
<Current directory>\coc\12ВЅГ°ВґГёГ±В©.bmp
<Current directory>\coc\11.bmp
<Current directory>\coc\10Г«В®ВґГёГ±В©.bmp
<Current directory>\coc\9В±ВѕГЇГў.bmp
<Current directory>\coc\9ВЅГ°ВґГёГ±В©.bmp
<Current directory>\coc\9Г«В®.bmp
<Current directory>\coc\9Г«В®1.bmp
<Current directory>\coc\10.bmp
<Current directory>\coc\10b-1.bmp
<Current directory>\coc\10b-1ВґГёГ±В©.bmp
<Current directory>\coc\10b-2.bmp
<Current directory>\coc\10b-2ВґГёГ±В©.bmp
<Current directory>\coc\10b-3.bmp
<Current directory>\coc\9В·ВЁГЄВ¦Г«Гѕ.bmp
<Current directory>\coc\10b-4.bmp
<Current directory>\coc\10В±Вѕ-1.bmp
<Current directory>\coc\10В±Вѕ-2.bmp
<Current directory>\coc\10В±Вѕ-3.bmp
<Current directory>\coc\10В±Вѕ-4.bmp
<Current directory>\coc\10В±ВѕГ©ГЇ.bmp
<Current directory>\coc\10В±ВѕГЇГў.bmp
<Current directory>\coc\10ВЅГ°ВґГёГ±В©.bmp
<Current directory>\coc\10Г«В®.bmp
<Current directory>\coc\15-1.bmp
<Current directory>\coc\10fen.bmp
<Current directory>\coc\16.bmp
<Current directory>\coc\11-12В·Г»Г«В®ВґГёГ±В©ВјГіГ«Г№.bmp
<Current directory>\coc\16-3.bmp
<Current directory>\coc\39.bmp
<Current directory>\coc\41.bmp
<Current directory>\coc\42.bmp
<Current directory>\coc\43.bmp
<Current directory>\coc\44.bmp
<Current directory>\coc\45.bmp
<Current directory>\coc\46.bmp
<Current directory>\coc\47.bmp
<Current directory>\coc\48.bmp
<Current directory>\coc\49.bmp
<Current directory>\coc\50.bmp
<Current directory>\coc\51.bmp
<Current directory>\coc\52.bmp
<Current directory>\coc\53.bmp
<Current directory>\coc\54.bmp
<Current directory>\coc\55.bmp
<Current directory>\coc\56.bmp
<Current directory>\coc\57.bmp
<Current directory>\coc\58.bmp
<Current directory>\coc\59.bmp
<Current directory>\coc\38.bmp
<Current directory>\coc\16-4.bmp
<Current directory>\coc\40.bmp
<Current directory>\coc\ГґГєГґГ¬ВµВЇГ¬Гё.bmp
<Current directory>\coc\5В±ВѕВґГІВ·ВЁ.ini
<Current directory>\coc\35.bmp
<Current directory>\coc\18.bmp
<Current directory>\coc\19.bmp
<Current directory>\coc\19-1.bmp
<Current directory>\coc\20.bmp
<Current directory>\coc\21.bmp
<Current directory>\coc\22.bmp
<Current directory>\coc\23.bmp
<Current directory>\coc\24.bmp
<Current directory>\coc\25.bmp
<Current directory>\coc\17.bmp
<Current directory>\coc\26.bmp
<Current directory>\coc\26-2.bmp
<Current directory>\coc\27.bmp
<Current directory>\coc\28.bmp
<Current directory>\coc\29.bmp
<Current directory>\coc\30.bmp
<Current directory>\coc\31.bmp
<Current directory>\coc\32.bmp
<Current directory>\coc\33.bmp
<Current directory>\coc\34.bmp
<Current directory>\coc\26-1.bmp
<Current directory>\coc\37.bmp
<Current directory>\coc\6В±ВѕВґГІВ·ВЁ.ini

Deletes the following files

%TEMP%\plugin.zip
%TEMP%\mymacro.zip
<Current directory>\shieldmodule.dat

Moves the following files

from %TEMP%\background.bmp to %TEMP%\68cbackground.bmp

Network activity

TCP

HTTP GET requests

http://c.###huoa.com/banner/Q10719.htm
http://c.###huoa.com/c2/MymacroidSalesUrl.aspx?my#######################

UDP

DNS ASK c.###huoa.com

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Executes the following

'%WINDIR%\syswow64\regsvr32.exe' atl.dll /s

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial